Tenora — Privacy Policy

Effective date: September 24, 2026 · Applies to the Tenora Android app (package app.tenora.android)

Tenora is a personal blood pressure, pulse, blood glucose and weight diary. This policy explains what information the app works with, where it is stored, when it can ever leave your device, and what choices and rights you have. Tenora is not a medical device and does not provide medical advice, diagnosis or treatment recommendations.

1. Information the app works with

Profile information you enter: name, date of birth, sex, height, a colour you pick for the profile.
Health readings you enter or import: blood pressure, pulse, blood glucose, weight, plus optional comments, symptoms and which medications were taken.
Medications and reminders you set up: names, dosages, schedules, and your log of intakes.
A camera-based pulse estimate (optional): if you use the camera to measure your pulse, the app analyses the colour change of your fingertip in real time to estimate a heart-rate value. No photo or video is ever taken, saved or transmitted — only the numeric result is kept, exactly like a manually entered pulse reading.
Bluetooth device readings (optional): if you connect a supported blood-pressure monitor, glucose meter, scale or heart-rate strap, the app reads the measurement from the device over standard Bluetooth Low Energy profiles. This does not use or read your location — Android requires the Bluetooth scanning permission to be declared with the neverForLocation flag, which Tenora uses.
Health Connect data (optional): if you turn on synchronisation, Tenora reads and/or writes blood pressure, heart rate, blood glucose, weight and height through Android's Health Connect — only for the types you approve, and only in the direction you choose (import, export, or both). This data stays on your device; Health Connect is a system component, not a service operated by us.
Subscription status: if you purchase Tenora Pro, Google Play Billing handles the payment and tells the app only whether your subscription is active. Tenora never sees your payment details.
Advertising identifiers (free version only): Google AdMob, used to show a full-screen ad, may collect a device advertising identifier and technical/diagnostic data as described in Google's own privacy policy (see §5). Tenora sends no personal information, keywords or context in the ad request itself.

Tenora does not collect your precise location, contacts, microphone audio, or files outside its own storage, and it has no analytics or crash-reporting SDK collecting usage data at this time.

2. Where your data is stored

All health readings, profile information, medications and settings are stored only on your device, in a local database encrypted with SQLCipher (AES-256). The encryption key itself is protected by the Android Keystore. This data is deliberately excluded from Android's automatic device backup and from device-to-device transfer (allowBackup="false"), so it is never copied anywhere by the operating system without your own action.

3. When data can leave your device — and to where

Tenora has no server of its own. Your health data can only leave your device when you take one of these actions:

Where it goes	What is sent	When
Your own Google Drive	A JSON backup (optionally password-encrypted) and, if you choose, PDF/CSV copies of your last 30 days	Manual backup, or scheduled auto-backup you turned on. Tenora only requests the `drive.file` and `drive.appdata` scopes — it can read/write only the files it created itself, never your other Drive content.
A folder you choose on your device	The same export files	Auto-export to a folder, if you turned it on
Another app, or a printer	An export file (CSV/PDF/JSON)	When you tap Share or Print
Health Connect	The health types you approved, in the direction you chose	Sync you turned on. Stays on your device.
Google Play	Purchase/subscription data	When you buy or check your Pro status
Google AdMob (free version only)	Advertising/device identifiers, per Google's SDK	When a full-screen ad is shown

Your health data is never sent to the advertising module: in Tenora's own code architecture, the ads component has no dependency on the database or data layer, so it has no technical means to access your readings.

4. Consent for health data

The first time you use Tenora, the app asks for your explicit consent to process health data on your device, consistent with GDPR's approach to special-category data. You can withdraw this consent at any time from Privacy settings, which also lets you delete all data stored by the app.

5. Third-party services

Tenora relies on the following services, each governed by its own provider's privacy policy:

Google Play Billing — subscription purchases.
Google Drive — only if you connect it, for backups you control.
Android Health Connect — only if you turn on sync; a system component of your device, not a Google server.
Google AdMob — free version only, to show ads. Where required by law (for example in the EEA/UK), a consent form (Google's User Messaging Platform) asks for your choice about personalised advertising before any ad is requested.

General information about how Google uses data from apps that use its services: policies.google.com/privacy and policies.google.com/technologies/ads.

6. Your rights and choices

Access and export — export your data at any time as JSON, CSV or PDF from the Export screen.
Deletion — Settings → Privacy → "Delete all data" permanently erases everything stored on your device. Copies you already saved to Google Drive, a device folder, or shared elsewhere are not affected by this action and must be removed separately by you.
Withdraw consent — available in the same Privacy screen.
Disconnect Google Drive — revokes Tenora's access to your Drive from within the app.

7. Data security

Health data is encrypted at rest (SQLCipher, AES-256, Android-Keystore-protected key) and Tenora only communicates over encrypted connections (HTTPS) — the app's network security configuration does not permit unencrypted ("cleartext") traffic.

8. Children's privacy

Tenora is not directed at children and its intended audience is adults. A profile's date of birth is used only to select the correct health-classification scale for that profile (for example, whether paediatric or adult blood pressure ranges apply) — it does not change who may use the app.

9. Not a medical device

Tenora helps you keep a personal diary and shows general, internationally recognised classification ranges (such as ESC/AHA/ADA) for context. It does not diagnose any condition, does not replace professional medical advice, and you should always consult a qualified healthcare professional about your health.

10. Changes to this policy

If Tenora starts using a new data-processing service (for example, crash reporting or analytics), this policy will be updated before that change ships, and the effective date above will change accordingly.

11. Contact

Questions about this policy or your data: ua.mixerapps@gmail.com